Security services · People

Security awareness that changes habits.

Most attacks start with a person: a convincing email, a fake invoice, a call from a “bank”. Short, practical training and realistic phishing simulations turn your staff from the easiest target into an early-warning system.

Get a fixed-price quote
Monthly phishing simulationsLessons of a few minutes, not hoursReport rates tracked, not just clicks
phishing test · sample● demo
  1. FOUND Fake invoice clicked by 2 people in accounts
  2. PASSED Reported within 4 minutes by the front desk
  3. FLAGGED QR-code phish scanned on a personal phone
  4. FIXED Two-minute lesson sent automatically
  5. PASSED Finance team reported the CEO gift card scam
In plain words

Security awareness training teaches staff to recognise and report scams: phishing emails, fake invoices, WhatsApp and SMS fraud, scam calls and now AI-cloned voices. We run realistic phishing simulations every month, give a short lesson to anyone who clicks, and track the number that matters most: how many people report a suspicious message, and how quickly.

Cadence
Monthly
Format
Online and live sessions
Measures
Click and report rates
Pricing
Per user, per year
What good looks like

Fewer clicks. More reports.

Clicks will never reach zero. The goal is a workforce that reports quickly, so one person’s click becomes everyone’s warning.

Illustrative chart of a year-long awareness programme: the share of staff who click on simulated phishing falls month by month, while the share who report it rises. ILLUSTRATIVE · NOT CLIENT DATA CLICKED THE LINK REPORTED IT MONTH 1MONTH 6MONTH 12
The shape we aim for over a year of monthly simulations and short lessons. Real numbers depend on your starting point, and we report them honestly every month.
What we train for

The scams your staff actually get.

  • Phishing emails

    Fake logins, shared documents and “urgent” messages from IT.

  • Fake invoices and bank changes

    Business email compromise aimed at finance and procurement.

  • WhatsApp and SMS scams

    Messages from a “boss” or “bank” on personal phones.

  • Fake officials

    Calls and video calls from people posing as police, customs or regulators, including “digital arrest” scams.

  • QR code phishing

    Fake payment and login QR codes, on posters, emails and parcels.

  • AI voice clones and deepfakes

    Urgent requests from a cloned leader. See our deepfake drills.

  • Safe use of AI tools

    What never to paste into public AI tools.

  • Passwords and MFA

    Password managers, and why to never approve an unexpected MFA prompt.

  • Reporting

    One button, no blame, a quick thank-you.

Why it works

An annual slideshow vs. a habit.

Once-a-year training

Watched once, forgotten by lunch.

  • One long video, quickly forgotten
  • Same content for everyone
  • No way to tell whether it worked
  • Ticks a compliance box

HanulSec awareness programme

Little and often, measured every month.

  • Lessons of a few minutes each
  • Role-based: finance, HR, leaders and developers
  • Monthly simulations show real progress
  • Reporting culture measured and rewarded
  • Evidence for ISO 27001, SOC 2 and regulators
How it works

A rhythm staff barely notice.

  1. Month 1

    Baseline test

    An unannounced simulation, approved by leadership, to see where you start.

  2. Months 1–2

    Training rollout

    Short lessons by role, plus a live session for leaders and finance.

  3. Monthly

    Simulations

    Varied, realistic scenarios that get harder over time.

  4. Monthly

    Measurement

    Click rate, report rate and time to report, by department.

  5. Quarterly

    Refresh

    New scams, new lessons and a short report for leaders.

What you get

Progress you can measure.

HANULSECSecurity awareness quarterly report CLIENTSample · 900-person NBFC SUMMARY FOR LEADERS FINDINGS BY SEVERITYCritical0High2Medium5Low8 SIMULATIONS · 3 · STAFF · 900 REPORT RATE RISING Sample layout, not client data
  • 01
    Click and report dashboard

    Live results for every simulation.

  • 02
    Department risk scores

    Where to focus, without naming individuals.

  • 03
    Training completion tracking

    Evidence for auditors and regulators.

  • 04
    Quarterly trend report

    Two pages for leaders: progress, risks and next steps.

  • 05
    Leader and finance drills

    Targeted exercises for the people attackers aim at.

Who it is for

Every company with an inbox.

  • Any organisation whose staff use email and phones, which is all of them
  • Finance and HR teams who handle money and personal data
  • Banks, NBFCs and insurers with regulator training requirements
  • Companies preparing for ISO 27001 or SOC 2, which expect awareness training
  • Fast-growing teams with many new starters

No blame, ever

We never publish the names of people who click. Shaming makes people hide mistakes; thanking them for reporting makes them speak up. Results are shared by department, and individuals get a short lesson, not a reprimand.

Frameworks

Training that counts towards your audits.

ISO/IEC 27001Information security
SOC 2Trust Services Criteria
PCI DSS v4.0Card data security
NIST CSF 2.0Govern to recover
DPDP Act 2023With the DPDP Rules 2025

Emblems are HanulSec’s own artwork showing which frameworks our work maps to. They are not the owners’ logos and do not mean HanulSec is certified against them.

Questions

Questions buyers ask before they call us.

Q01What is a phishing simulation?
A safe, fake phishing email sent to staff with the approval of leadership. If someone clicks, nothing bad happens: they see a short lesson explaining the warning signs they missed.
Q02Is it fair to test our own staff?
Yes, when it is done fairly: leaders approve it, scenarios avoid cruel topics such as fake bonuses or layoffs, no one is named and shamed, and the aim is learning, not catching people out.
Q03How often should we run training?
Short and regular beats long and rare. We recommend a simulation every month, a few minutes of training each quarter for everyone, and extra sessions for high-risk roles such as finance and executive assistants.
Q04Do you cover WhatsApp, SMS and phone scams?
Yes. Training covers email, SMS, WhatsApp, QR codes and phone and video calls, including fake officials and AI-cloned voices. Simulations by SMS or voice are agreed with you first.
Q05Does this help with ISO 27001 and SOC 2?
Yes. ISO/IEC 27001 (Annex A control 6.3) requires information security awareness, education and training, and SOC 2 auditors expect evidence of it. Our reports give you that evidence.
Q06How is it priced?
Per user, per year. Live sessions and targeted drills for leaders and finance are priced separately.
Next hops

Related services

Request a quote

Scope it in two minutes.

Tell us what you need protected. A security engineer, not a salesperson, replies with a fixed-price proposal.

Start your quote hello@hanulsec.com
  • Reply within one business day
  • Free 30-minute scoping call
  • Mutual NDA before any detail is shared
  • Fixed price, free retest of fixed findings